>>All the rest you say I'm sure is very true, and that's why it worked so effectively. I saw the .VBS Rename inside the code, too.
>
>Except one detail, that is - it did not run WSH, unless it copied new versions of WSCRIPT and CSCRIPT, I guess. We had those two files removed on all machines, and still the virus ran fine.

Oh Bruce...there's another file involved. Look in your SYSTEM directory for WSHOM.OCX and click the version tab from the properties dialog and see what that tells you.< beg >